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(U) OFFICE OF THE INSPECTOR GENERAL 

(U) Chartered by the NSA Director and by statute, the Office of the Inspector 
General conducts audits, investigations, inspections, and special studies. Its 
mission is to ensure the integrity, efficiency, and effectiveness of NSA operations, 
provide intelligence oversight, protect against fraud, waste, and mismanagement of 
resources by the Agency and its affiliates, and ensure that NSA activities comply 
with the law. The OIG also serves as an ombudsman, assisting NSA/CSS 
employees, civilian and military. 


(U) AUDITS 

(U) The audit function provides independent assessments of programs and 
organizations. Performance audits evaluate the effectiveness and efficiency of 
entities and programs and their internal controls. Financial audits determine the 
accuracy of the Agency’s financial statements. All audits are conducted in 
accordance with standards established by the Comptroller General of the United 
States. 


(U) INVESTIGATIONS 

(U) The OIG administers a system for receiving complaints (including anonymous 
tips) about fraud, waste, and mismanagement. Investigations may be undertaken in 
response to those complaints, at the request of management, as the result of 
irregularities that surface during inspections and audits, or at the initiative of the 
Inspector General. 


(U) INTELLIGENCE OVERSIGHT 

(U) Intelligence oversight is designed to insure that Agency intelligence functions 
comply with federal law, executive orders, and DoD and NSA policies. The 10 
mission is grounded in Executive Order 12333, which establishes broad principles 
under which IC components must accomplish their missions. 

(U) FIELD INSPECTIONS 

(U) Inspections are organizational reviews that assess the effectiveness and 
efficiency of Agency components. The Field Inspections Division also partners 
with Inspectors General of the Service Cryptologic Elements and other IC entities 
to jointly inspect consolidated cryptologic facilities. 


TOR SECRET/ZOmorORN - 


Release: 2019-04 
NSA:08115 



Doc ID: 6661014 


top r, rrr?rTi // ^ r ( / MnmfiT i r iv-13-0095 


(b) (3)-P.L. 
(b) (6) 


86-36 


I. (U) SUMMARY 


♦ . 

♦ # . ♦ 

(U/TTOttO * 1 ) This investigation? was conducted in response to a complaint alleging that 

I / ; ♦. 

failed to report a violation of the Foreign Intelligence Surveillance Act (FISA). 

: 

■ • ♦ 

(U/fFOUO) The complaint alleged that oh.9 September 2013 FISA information which had 

. 1 « i.i ■ * 


exc eeded the one ye ar retention authority was discovered in a data repository withirj |and 

that )! | was told a bout the retentio n- violation. The FISA information waj deleted on 

10 September 2014. Although ! I was told that FISA information was being retained 

longer than permitted on 9 September 2013, she did not report the unauthorized retention 
violation to the Signals Intelligence Directorate (SID) .Oversight and Compliance office until 
after-being interviewed by thepiG on 26 September 201.3. 


(b) (3)-P.L. 86-36 


(U/fFOUO) United States Signals Intelligence Directive (USSID) SP0018, Legal Compliance 
and U.S. Persons Minimization Procedures, dated 25 January 2 j 01 1 states that, for retention, 
“sufficient duration is one year unless the Deputy Director for Operations, NSA, determines in 
writing that retention for a longer period is required to respond to authorized foreign intelligence 
or counterintelligence activities.” SID Oversight and Compliance FISA-Related Responsibilities 
Memorandum, dated 10 August 2006, requires that SID Oversight and*Compliance be notified 
“immediately” of any FISA incidents that stem from improper collectionVprocessing, retention, 
or dissemination. USSID SPO019, NSA/CSS SID Oversight and Compliance. Policy, dated 13 
November 2012, requires that a collection incident “must be reported” to local .management and 
Oversight and Compliance “upon recognition, or as soon as practicable.” 


(U// FOUQ ) Based upon the preponderance of the evidence, the OIG concludes that ] | 

I ~~| failed to no tify SID Oversigh t and Compliance of a FISA incident upon recognition, or 

as soon as practicable. ! I failure to report this FISA incident in a timely manner 

was in violation of SID Oversight and Compliance FISA-Related Responsibilities Memorandum 
and of USSID SP0019. NSA/CSS SID Oversight and Compliance Policy. 


(U/jTOUO) A copy of this OIG report will be forwarded to MR, Employee Relations, for 
information and appropriate action. 
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II. (U) BACKGROUND 


(U) Introduction 


(b) (3)-P.L. 86-36 


(u/ /foii e-)[ 


.. '■ 

-r • ♦ i* • ; 

Jbrangh. maintain^ data/epo^totfes that have^trict age-off 


scripts’ to ensure that a!I|_ 
systems after being retained to r^ong year. On 9 September 3*0*13 [~T 


^ V 1 U 6 U 1 11 

JFISA informatiorf is rem oved from databases and file 


d iscovered t hat FJSA inform ation that Exceeded the’one year 
:ing stored in the |. » , ♦ d irectory. -This j i d irectory is 


not 


retention authority was being 

accessible to analyst query. Data is stored’there to comply with Agency continuity of operations 
planning. -* ♦ ■ • 

♦ ♦ • 

(U//Fey) The age-off scripts were written t d capture and delete FlSA information older than 
one year j ,»* ]f ‘ * 

scripts entered into 


|TheJFISA information wh ich eluded the age-off 


ij wh i 

-- —... . | There wure 

approximately ! I zip tiles identified that contained FISA information that had been retained 
beyond the one year authority. The FISA information exceeded the One year retention authority 
between one and approximately one hundred days. ! 

♦ ■ 

(U//FWe) Software developers assigned to th j ( branch have-'since deleted all 

FISA information that was being retained be yond the one year authority and hav e written new 
age-off scripts to capture FISA data receivedf" | 


(U//POUO) The[ 


"(branch submitted detailed reports of the FISA information 


retention violation to the SID Oversight and Compliance office and the NS A Office of General 
Counsel after being contacted by the OIG on 26 September 2013. 


(U) Applicable Authorities 


(U) The following authorities are applicable to this investigation. The details of the following 
authorities are included in Appendix A. 


• (U) United States Signals Intelligence Directive USSID SP0018 Legal 
Compliance and U.S. Persons Minimization Procedures 

• (U) United States Signals Intelligence Directive USSID SP0019 NSA/CSS 
Signals Intelligence Directorate - Oversight and Compliance Policy 

• (U//rOUO) Signals Intelligence Directorate Oversight and Compliance 
Information Memorandum, FISA-Related Responsibilities 


1 (U) An age-off script is a software program that is designed to automatically delete information after 
that information reaches a certain age. 
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III. (U) FINDINGS 


(U/mVG} Issue: Did[ 


[fail to report the improper retention of 


FISA data upon recognition, or as soon as practicable? 

m 

(U/7TOUO) CONCLUSION: Substantiated . The preponderance of the evidence 
supports the conclusion that \ [ failed to report the improper retention of 

FISA data, a FISA incident, upon recognition, or as soon as practicable, in violation of 
USSID SP0019, NS A/CSS Oversight and Compliance Policy and SID Oversight and 
Compliance Memorandum, FISA-Related-Responsibilities. 


(U) Documentary Evidence 


(b)(3)-P.L. 86-36 
(b) (6) 


♦ * 


♦ ** 

(U//F0U9) NSA/CSS Intelligence-Relatobncident Report. O n 26 September 2013 a 
NSA/ CSS Intel ligence-Related Incident Report was submitted by| : |Deputy 

Chief,! [concerning the improper intention of FISA information that was discovered on 9 

September 2013 (Appendix B).. * .* ."<• \ 

*. ♦ * •. 

(U//FOUO ) Email fromj ~ [m anagement. 26 September 2013. This 

email from| Ito hefmanagemenl chain.describes the discover y of th e FISA 

information retention violation on 9 September 2013.*This email infornied lH management 
that a FISA incident report was not Submitted .when the FISA information retention violation 

was discovered but that an incident*rt?pori wcjuld be forthcomiijg(Appendix C). * 

* ■ ♦ * ■ * ■ 

• »• ■ * * 

* m ^ » a 

(U//FOUQ) Email from | * . .. |to | . | management, lb*Sefrtember 1013. This 

email fromj- |to her/ntanagemen} chain informs them that the FISA information 

that was being retained beyond the retention authority had "beefi-deleted (Appendix'D). 

t t t mm m + m 

• * * 

(U) Testimonial Evidence.*.* 




(U/zTO U fr) 


(U/ / F OU Q)[ 




(b) (3)-P.L. 86-36 


]was interviewed on 26 September.20II I * .« f bfovided the 

iy.. . . • * . . , . 


following sworn testimony. 

(U//FOUQ-)|_Jtas been assigned *to tht j X I branch since January 


2007. She has been the chief of this.bfanch since November 2G1’2 

• . * ♦ ♦♦ 

. . * * 


1 


(U//FQ U Q- I 
bases in supty rttif j 

' Jb 


. • * fsaid that thef 


^branch develops and .maintains data 


f _jutaucii ucvciups ana.n 
The information that thfc f 

Ibranch receives from[__Contains FISA informatio n. TheF b ranch is allowed 


to retain FISA information for a period not to exceed one year. The | S oftware analysts have 
designed programs to automatically age off (delete) FISA information after one year. 
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(UZ/FOUQ) On *Q September.^!) 1*3*acontractor‘assigned tptfi ej *.. not ified 

t tfrat FISA information was.being refafned beyond o'nb year. .The next day"| | 
r eported this retentron'.violation By email to her immediate . managers.] ~| 

said that she did.’not make ajiy.furtjier notificatioris-tp Agency Officials ] I saidlhat 

she was waitingfor a report oil the-extent of the FISA* retention violation from the analyst who 

wrote the automatic age off scripts but that she forgot to ask: the analyst for that report. 

■ " * ♦ 

(U//HDUO) ! ; [ saicFthat she knows she should have submined an Intelligence- 

Related Incident- Report to the’Gversigtlt and Compliance office to report’the unauthorized 
retention of FISA information-once she was notified of the retention violation ]" ~| 

said that she kndws the “onus’*. iS on her to report the unauthorized retention of FISA information 
but that she "got busy” with other work. *. 

+ 

(u//FQyQ) |~~; ; • \ ; | 

(U/ZrQUO) | ; ~| was interviewed on 26-September 2043 and 15 January 2014 and 
provided the following sworn testimony. ’. .* [ 


(U/ffOUQl i I l has been assigned to the) 

been the deputy-chief of that branch since January 2013. 


I branch since 2004 and has 


(U//FOUQ H I [ said that the retention of FISA information has a very strict one year 

retention authority. Agency.polipy inquires that incidents involving the retention of FISA 
information beyond one /ear constitutes a violation of FfSA handling authorities which must be 

reported to the § ID Oversight and Compliance office within 24 hours of discovery. 

■ "** ■ ■ ■ ■ 

• ■ • m m # 

(UZ/FOGO)| . |s did that on-9 September"2013 a contractor working in th e! | 

| jb rhnch discovered that f ISA information was being retained longer tban one year. 

On 10 September 2013 this unauthorized retentioji was confirmed by the software-developer who 
had written the program to-automatically age off FISA information once it had reached its one 
year ret ention dale. Th e FI$A-mforma tion that had be en retairjed.Ionger than one year was 
deleted. | ■ * js aid thai'she and ) ■: I were notified of the retention violation on 9 

September 2013- • .■ ! 

. * * * 7* ■ ■■ ■ * 

• « V i 

(U//F0GO) | ■ *. -Js aid-tligt l js fcnt an email to thei r management c hain to 

notify them abcjut the FJSA information retentioni-violation. However] . |did not 

report this retention viofefton tb-SID Oversight artU Compliance via an Intelligence-Related 
Incident Report as requiradr“I Cap honestly tell you that I dorft believe-anybody turned in that 
incident report that should*have-been turned in.” ' 

_j_ • *.. 'X ' ’ 

(UZ/TOUOl I (said fhat.it was “definitely” the fault of management for not submitting 

an Intel ligence-jRelated Ineidenl^ Report to SID Oversight and Compliance ] ~~l said that 

she and | | are knpwledgeable “of the'law” and they both know that an Intelligence- 

Related Inci dent Report sh ould havf been submitted within 24 heursJO SID Oversight and 
Compliance. ) Is aid thautoanagement ‘idropped theibalj-’by not reporting this FISA 

violation. * * • . .* 3 j / ♦ * 

| (b)(3)-P.L. 86-36 I 
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(b) (3)-P.L. 86-36 
(b) (6) 


(U//Fewe)|.Isai d that she even tually submiMecffhe IntelliVenrp-RplatPH 

ReDort on behalf of thel . hrn«,.k «.Oa . • . 


Report on b ehalf of thel 
by the OIG. | I sakfthat-shedhrl 

wlaoiRre 


brancU©rt_i6Sepf«nber 2013 after being interviewed 
Trussed submitting the incident report 


1 


with their management who agreed that this report shoul<£havp been filed on 10 September 2013 
^submitted the Melljgence-Related Incident.-Report on 26 September because!—I 
^ ts^part-time employee,‘had reached tte enfl of her work day.|- | an d 

Idid fldt Want to wait anv ionofr tn cnkcirv a. “J _ i 1 


J 


I— : * * r ”..cup vi nci wont aay.i 

I ,, l did ndt w^nt to wait any Iqnger to subrpit this report to SID Oversight 
Compliance. • • 

# ♦ * ♦ * ♦** ♦ ■ 1 
(U//rOUO)l |s aid that the FfSA information in‘question was not accessible to ‘ 

analysts and that queries cdirfd no; have been made.against, if.-Agency analysts do not have * 
access to the data sto rage area where‘this FISA..mforhtafiVn*w^.stored. The FISA information 

was being stored in a f (a rea which hadb'eeri created‘.t$c<5mply with Agency continuity of 

operations planning. ....VC___' 


(U/ 7 -Fefc*€)f 


* * 
* * 

♦ * 

♦ * 

T' t 


(b) (3)-P.L. 86-36 


- * **“ Av* 1 


(U//F0«©)|" 

testimony. 


- r- 

— 1 . * " .; •’ ^ ,» 

. • • • * *; * ■ .♦ . • 

| was interyi^cf on 14 Janua^2aV^an’d pi 

. • • *. ♦ j* • *0 

.. • 

' f . ** ♦♦ »V* ♦* ■* ■ 

Isa in thai nn 0 _*_ 


provided the following swe 


UQ }LjJ____Jsaid that on 9 September 2D4 : 3. q'contractor assigned to the ) | . • 

I-.—pranch discovered “FISA information m a-data repository that had exceeded the one- 

year retention authority. The FISA information* ha*l esc aped detection and deletion heca.Ko th^ ’ 
age oil scripts were written to rantnrp fir a. - 1 


rp 


y^ai iticiiuuii cuuiiorny. i ne ri3A uftormation had escaped d 
age off scripts were written to cap ture FISA informatio*rf/7 

I ..•;/>;• Vt 

(hall . 1 ‘‘‘ * .fcid|_^__.__faskefl him to confirm that .' 
^ , 0 | r ^ | brTna 0rl WaS | j f retamed Ipttger th‘ari one y ear Hr' wa, a b| e t0 confirm the violation 


1 


f 


*'■ ♦ ♦ • • . _paid that he immediately wrote new 

program scripts that id&nt i tied and-deIete'd any FISA information that was being retained longer 
than one year. In al. he ftand|,- |zip files that contained FpA information. All of this FISA' 
information was delated! . * fsaid.that analysts did not have access to this data ■ 
repository and could/tot qqery this information. 

X* * / * ■ 

(U//peeej 


Related IncidenfReport. 


said that he d id not know iff 

13. 


Jsubmitted an Intelligenco- 


... ■ J sa 'd ^at his responsibility is to recognize a compliance 

violation and r epo rt it to his bran ch management. He knew this violation had been reported to 

I- / |and|_ |because he was asked to verify the unauthorized retention fH 

|-_paid that he was fixated on writing new age off scripts to bring the office into '- 

compliance and he did not think about who was going to report the violation. 
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(U) ANALYSIS AND CONCLUSION 

r _ r .; 

(U//FOU©) I K vas notified of the FISA, retention* violation 


(b) (3) 
(b) (6) 


■P.L. 86-36 


the day the violation was discovered.C 
of the retention violation.^ 


—. —--.. on 9 September 2013, 

'. kllneefed a subordinate to find out the details 

■ ■ 


the violation via e mail. H owever. 
Report as required.[ 


Tal^Q prud etttfy notified.fier immediate management of 
jfailed to submit an fntelligence-Related Incident 

chmilH Kd\/P an Irvtol Ii rr&nr*t> ■ ■ 

1 


testified that she should have subrtfitted an Intelligence- 


Related Incident Report once she was notified of the FISA*retentiorr vfolationT 

... , , ii . • » # . . 


said that she wanted to get additional details from the analyst who wa^reviewing the extent of 

the incident but that she forgot to ask for that information. A n Intefligahce-R elated Incident 

Report was eventually submitted on 26 September 2013 after ! • .** I was interviewed by 

the OIG. .* . 

♦ 

_ _ .* * 

(U//FOUO) The instructions for completing the* Intelligence-Related Incident Report states that 

the form “...should be used to submit both initial and final incident reports. Please complete as 

much information with the initial incident report as is available qt the tjine of submission.” The 

report submission process allows for an initial report to be submitted y dth partial inform ation and 

a later report with more details to be submitted. It is understandable for ) h o want 

the complete details of this event butshe should have fulfilled |jer reporting obligations by 

submitting a timely, initial report. .* 

♦ 

■ 

♦ • ■ 

(U//FOU©) United States Signals Intelligence Directive SP00.19 requires the reporting of any 
non-compliant activity to Oversight and Compliance upon recognitiorj-or as soon as practicable 
FISA and FISA Amendments Act incidents need immediate ceporting-'so that external overseers 
can be notified. The SID.Oversight and Compliance FISA-R£lated Responsibilities 
Memorandum states that notice be provided as soon as possible upon Recognition of any FISA ' 
incident stemming frqfn improper retention. * ■! 


♦ • 

(U//*POU©) All Agency employees have the respons ibility to report nbn-comp liant activity upqn 
recognition or a^soon as practicable. As the Chief of j . I ■ I received notice of a 

FISA retentiojf violation from a contractor assigned to her' branch and tasked a subordinate to 
determine the extent of the violation. Once ! ~| was notified-of the incident she shoul d 

have made -a report, or as a manager ensured a report was made, as required by regulation ! f 
f recognized this obligation when she testified thqt she should-have submitted an 
Intelligence-Related Incident Report but failed to do so. • ! 


(U/ / F OUQ ) Based on the above information, we conclude'that ! ' I failed to report a 
FISA incident (retention violation) upon recognition, or as-soon as practicable, in violation of 
USSID SP0019 and SID Oversight and Compliance Memorandum, FISA-Related 
Responsibilities. 


(b) (3)-P.L. 86-36 
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IV. (U) RESPONSE TO TENTATIVE CONCLUSION 


(U/7FPfcfrO j The OIG’s Tentative Conclusion was sent to| ' Ion 5 June 2014.1 I 

lp rovided the following response to the.OIG’s Tentative Conclusion on 23 June2014. 


(U/7F0*4Q) l am aware of the mistake Kve made. I‘ve learned 

fro m it an d wijl not allow it to happen again. While working more closely with 
the | jc ompllance officer, several other incidents have been brought to my.* 
attention since this One. Each corresponding report has been entered in a timelv 
fashion.” " 

• ♦ ♦ ■ 
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V. (U) CONCLUSION 


(U// FOUQ ) The preponderance of the evidence supports the conclusion tha tj | 

failed to report a FISA incident (improper retention) upon recognition, or as^oon as practicable. 


in violation of USSID SP0019. NSA/CSS Oversight and Compliance Policy; 
and Compliance Memorandum, FISA-Related Responsibilities. 


and SID Oversight 


(b)(3)-P.L. 86-36 
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VI. (U) DISTRIBUTION OF RESULTS 

(U/7FW9) This report of investigation will be provided to M/ER for information and 
appropriate action. 



Concurred by: 



Assistant Inspector General 


for 

Investigations 
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Appendix A 

Applicable Authorities 

(U//T0U9) United States Signals Intelligence Directive USSID SP0018, Legal Compliance and 
U.S. Persons Minimization Procedures, 25 January 2011 

Section 5 - (U) Domestic Communications 
(b) (U) Retention (2) b. 

(U) In the case of communications that are not enciphered or otherwise thought to 
contain secret meaning, sufficient duration is one year unless the Deputy Director for 
Operations, NSA, determines in writing that retention for a longer period is required 
to respond to authorized foreign intelligence or counterintelligence requirements. 

Section 6 - (U) Foreign Communications of or Concerning United States Persons 
(a) (U) Retention (1) b. 

(U) IN the case of communications that are not enciphered or otherwise thought to 
contain secret meaning, sufficient duration is one year unless the Deputy Director for 
Operations, NSA, determines in writing that retention for a longer period is required 
to respond to authorized foreign intelligence or counterintelligence requirements. 

(U//FOUO) United States Signals Intelligence Directive USSID SP0019, NSA/CSS Signals 
Intelligence Directorate - Oversight and Compliance Policy. 13 November 2012 

Section 3 - (U) Responsibilities 
(U) Individuals and Managers, 3.6 

(U) Every individual must comply with applicable laws, statutes, directives, and 
regulations by: 

(U//E OUO) Reporting any non-compliant activity to management, an IOO, SV. and 
OIG. 

Section 4 - (U) Policy and Procedures 

(U) 4.1 Five Foundational Components of Compliance: 

No. 4. (U) Reporting of non-compliant activity. 

(U) Reporting Incidents of Non-Compliance 

(U//f*OUG) All incidents of SIGINT mission non-compliance must be reported to SV 
and the OIG in accordance with established guidelines as follows: 

(U) When and how should the incident be reported? 
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(U//TOU©) An incident must be reported to local management, SV, and the OIG, 
with a copy sent to the sponsoring mission owner, upon recognition, or as soon as 
practicable...Updates to the initial incident report must be filed as additional 
information becomes available. For FISA and FISA Amendments Act incidents, 
NSA/CSS is responsible to also report incidents immediately upon recognition to 
the NSA/CSS OGC, which may report the information to external customers. 

(U//FOUO) SID Oversight and Compliance FISA-Related Responsibilities - INFORMATION 
MEMORANDUM, 10 August 2006 

(U//POUG) Individual Responsibilities 

(U/ / FQ U Q) L. To notify SID Oversight and Compliance immediately of an FISA 
incidents that stem from improper collection, processing, retention, and/or dissemination. 
A formal write-up providing the details of the incident, routed through the appropriate 
signature chain, should be provided to SID Oversight and Compliance as soon as possible 
upon recognition of the incident. 
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(U//F©UO)»NS A/CSS Intelligence-Related Incident Report 
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Th a minimum classification far this form is SECRET//COMIN I//HEI ro USA, FVfc V. The classification may be higher based^h^krHIF ut Tm o " 

the form. See the 'Overall Incident Glassification" field on page 1. 


(U) NS A/CSS Intelligence-Related Incident Report 
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(b) 

(1) 




(b) 

(3) - 

-18 

use 

798 

(b) 

(3) - 

-50 

use 

3024 (i) 

(b) 

(3) - 

-P.L. 86 

-36 

(b) 

(6) 
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Appendix C 


(b) (3)-P.L. 86-36 


(U//FWM1) Email from 


^|to | [ management, 26 September 2013 


(b) (3)-P.L. 86-36 
(b) (6) 
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Apologize for not reporting immediately. 
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Appendix D 
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